Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →asgard-ai-platform/law-gdpr-pdpa
Analyze data privacy compliance requirements under GDPR, Taiwan's Personal Data Protection Act (PDPA), and related regulations.
Passed 15 of 25 test cases with the skill, and 4 of 25 without it.
and 5 more in the full report
11 fixed4 passed either way10 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 11 test cases the skill fixed. Same model, same prompt, with and without the skill.
Our Taiwanese online retail business recently began accepting orders and shipping products to customers in the EU. We gather user contact details, payment information, browsing cookies, and share delivery addresses with international logistics partners. Please run a privacy compliance audit under EU GDPR and Taiwan PDPA regulations. Present the results using a structured assessment report format that includes a data inventory table breakdown (covering categories, field types, legal basis, business purposes, and retention duration), a compliance gap analysis table showing status checks and priority, and a prioritized remediation roadmap with estimated execution timelines in weeks.
| Checked | Without skill | With skill |
|---|---|---|
| Includes Legal Basis as a column header in the data inventory table. | Passed | Passed |
| Flags cross-border data transfer without safeguards as a compliance gap. | Passed | Passed |
| Formats remediation plan entries using the inline pattern — priority: [H/M/L] — timeline: [X weeks]. | Missed | Passed |
The instructions your model reads when the skill loads.
Data privacy law governs how organizations collect, process, store, and share personal data. GDPR (EU) is the global benchmark; Taiwan's PDPA (個人資料保護法) applies domestically. Both share core principles but differ in scope, enforcement, and specific requirements.
IRON LAW: No Collection Without Legal Basis
You CANNOT collect or process personal data just because you want to.
Every data processing activity requires a legal basis:
- GDPR: 6 legal bases (consent, contract, legal obligation, vital interests, public task, legitimate interests)
- Taiwan PDPA: Specific purposes listed in the act, with consent as primary basis
"We need this data for analytics" is NOT a legal basis.
| Aspect | GDPR | Taiwan PDPA |
|---|---|---|
| Scope | Any org processing EU residents' data | Any org processing personal data in Taiwan |
| Legal bases | 6 enumerated bases | Consent-centric + specific purpose limitation |
| Consent standard | Freely given, specific, informed, unambiguous, opt-in | Written consent required for sensitive data; implied consent possible for non-sensitive |
| Data subject rights | Access, rectification, erasure, portability, restriction, objection | Access, correction, deletion, cessation of processing |
| Cross-border transfer | Adequacy decision, SCCs, BCRs | Requires central authority approval or adequate protection |
| Breach notification | 72 hours to authority | Report to authority + notify affected individuals "without delay" |
| Penalties | Up to €20M or 4% global turnover | Up to NT$500K per violation (criminal penalties possible) |
| DPO required? | Yes (in certain cases) | Not explicitly required |
test cases passed, vs 4 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.